Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

  7. current community

    your communities

    more stack exchange communities

    company blog
Reverse Engineering Beta

Questions tagged [capstone]

Ask Question

A lightweight multi-platform, multi-architecture disassembly framework.

7 questions
Info Newest Frequent Votes Active Unanswered
0
votes
0answers
76 views

Capstone in reverse mode

I am using capstone in python in order to dissassemble binary instructions. Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate ...
1
vote
1answer
190 views

Capstone: What's the purpose of the 'address' argument in cs_disasm()?

I'm trying to play around with the Capstone Disassembler in C. In the documentation they show the following use of the cs_disasm() function: from here count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
0
votes
1answer
92 views

Operand address in Capstone disassembly is not the same as in IDA/HIEW

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW. Here is the machine code: 0x48, 0x8D, 0x0D, 0xED, 0x44, ...
1
vote
0answers
126 views

Pointer disassembly

I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version. My goal is to implement the recursive traversal now. Consider ...
0
votes
1answer
245 views

How to DUMP the full hexa of each function extracted by analysis of binary file?

I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each ...
1
vote
1answer
116 views

capstone disasm framework - check if argument read/written

I cam using the capstone disassembly framework to disassemble intel x86 code. I need to find out which operands are read to or written from (or both). According to the website, this is possible by ...
3
votes
1answer
1k views

Limitations of capstone's disassembly capabilities compared to IDA

I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA. If yes, are those limitations inherent, i.e. a result of the different design/techniques ...